fix: signer-scoped DirectV1 routing (#162)

Core is no longer account-aware: the client resolves an account address
to signer ids via the account directory, and the signer's verifying-key
hex serves as registry key, inbox subscription, and Welcome routing
target end to end. The MLS credential stays the full id().

- GroupV2 reads the de-mls member id from the fetched key package and
  maps it to the signer id the welcome is delivered to.
- All account machinery (directory trait, bundle codec, resolution)
  moves out of core into logos-account; the RegistrationService
  supertrait and Core::account_directory() are gone, and the client
  holds its own directory handle.
- The account exposes functionality, never a signer: add_delegate_signer
  does the lamport upsert and signs internally.
- Every client acts for an account (ChatClientBuilder::new(account)).
  DelegateSigner is a pure keypair; the client composes the wire
  credential from the signer and the account, so the association is
  client state. addr() is the account address.
- resolve_device_ids fails fast (NotAnAccountKey / NoDeviceBundle /
  Directory) instead of falling back to treating an unresolved address
  as a signer id. LogosChatClient::open and chat-cli mint and publish a
  dev account each launch.
- EphemeralRegistry keys key packages by hex pubkey like HttpRegistry.

Supersedes #155 (routing_id).

core/account/Cargo.toml

@@ -9,7 +9,8 @@ dev = []
 [dependencies]
 # Workspace dependencies (sorted)
 crypto = { workspace = true }
-libchat = { workspace = true }
 shared-traits = { workspace = true }
 
 # External dependencies (sorted)
+hex = "0.4.3"
+thiserror = "2"

core/account/src/account.rs

@@ -1,43 +1,183 @@
 use crypto::{Ed25519SigningKey, Ed25519VerifyingKey};
-use shared_traits::{IdentId, IdentIdRef};
 
-use libchat::IdentityProvider;
+use crate::directory::{AccountDirectory, SignedDeviceBundle, encode_bundle_payload};
 
-/// A Test Focused LogosAccount using a pre-defined identifier.
-/// The test account is not persisted, and uses a single user provided id.
+/// Failures updating an account's device bundle in the directory.
+#[derive(Debug, thiserror::Error)]
+pub enum AddDelegateSignerError {
+    #[error("directory: {0}")]
+    Directory(String),
+    #[error("directory returned a malformed device id")]
+    MalformedDeviceId,
+    #[error("directory returned a malformed device key")]
+    MalformedDeviceKey,
+}
+
+/// A Test Focused LogosAccount.
+/// The test account is not persisted.
 /// This account type should not be used in a production system.
 pub struct TestLogosAccount {
-    id: IdentId,
     signing_key: Ed25519SigningKey,
     verifying_key: Ed25519VerifyingKey,
 }
 
+impl Default for TestLogosAccount {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl TestLogosAccount {
-    pub fn new(explicit_id: impl Into<String>) -> Self {
+    pub fn new() -> Self {
         let signing_key = Ed25519SigningKey::generate();
         let verifying_key = signing_key.verifying_key();
         Self {
-            id: IdentId::new(explicit_id.into()),
             signing_key,
             verifying_key,
         }
     }
-}
 
-impl IdentityProvider for TestLogosAccount {
-    fn id(&self) -> IdentIdRef<'_> {
-        &self.id
-    }
-
-    fn display_name(&self) -> String {
-        self.id.to_string()
-    }
-
-    fn public_key(&self) -> &Ed25519VerifyingKey {
+    /// The account verifying key; its hex is the account address peers share.
+    pub fn public_key(&self) -> &Ed25519VerifyingKey {
         &self.verifying_key
     }
 
-    fn sign(&self, payload: &[u8]) -> crypto::Ed25519Signature {
-        self.signing_key.sign(payload)
+    /// The account address peers share: the hex of the verifying key.
+    pub fn address(&self) -> String {
+        hex::encode(self.verifying_key.as_ref())
+    }
+
+    /// Add `signer` (the delegate signer's verifying key) to this account's directory bundle.
+    ///
+    /// Fetches the current (verified) device set, adds the signer if absent,
+    /// bumps the lamport, re-signs, and publishes. Safe to call repeatedly:
+    /// an unchanged set is simply re-published, which also refreshes the
+    /// server's retention clock. The account signs internally; its key never
+    /// leaves this type.
+    pub fn add_delegate_signer<D: AccountDirectory>(
+        &self,
+        directory: &mut D,
+        signer: &Ed25519VerifyingKey,
+    ) -> Result<(), AddDelegateSignerError> {
+        // Start from the devices already registered so the account's other
+        // installations are preserved across the upsert.
+        let existing = directory
+            .fetch(&self.verifying_key)
+            .map_err(|e| AddDelegateSignerError::Directory(e.to_string()))?;
+        let (mut devices, next_lamport) = match existing {
+            Some(set) => {
+                let mut keys = Vec::with_capacity(set.devices.len() + 1);
+                for hex_id in &set.devices {
+                    let bytes: [u8; 32] = hex::decode(hex_id)
+                        .ok()
+                        .and_then(|b| b.try_into().ok())
+                        .ok_or(AddDelegateSignerError::MalformedDeviceId)?;
+                    let key = Ed25519VerifyingKey::from_bytes(&bytes)
+                        .map_err(|_| AddDelegateSignerError::MalformedDeviceKey)?;
+                    keys.push(key);
+                }
+                (keys, set.lamport + 1)
+            }
+            None => (Vec::new(), 0),
+        };
+
+        if !devices.iter().any(|d| d.as_ref() == signer.as_ref()) {
+            devices.push(signer.clone());
+        }
+
+        let payload = encode_bundle_payload(next_lamport, &devices);
+        let signature = self.signing_key.sign(&payload);
+        let bundle = SignedDeviceBundle {
+            account_pub: self.verifying_key.clone(),
+            payload,
+            signature,
+        };
+
+        directory
+            .publish(&bundle)
+            .map_err(|e| AddDelegateSignerError::Directory(e.to_string()))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::directory::{DeviceSet, verify_bundle};
+
+    use super::*;
+
+    /// Minimal in-test directory: stores the latest bundle, verifies on fetch.
+    #[derive(Debug, Default)]
+    struct FakeDir(Option<SignedDeviceBundle>);
+
+    impl AccountDirectory for FakeDir {
+        type Error = crate::directory::BundleError;
+        fn publish(&mut self, bundle: &SignedDeviceBundle) -> Result<(), Self::Error> {
+            self.0 = Some(bundle.clone());
+            Ok(())
+        }
+        fn fetch(&self, account: &Ed25519VerifyingKey) -> Result<Option<DeviceSet>, Self::Error> {
+            self.0
+                .as_ref()
+                .map(|b| verify_bundle(account, b))
+                .transpose()
+        }
+    }
+
+    fn device_set(dir: &FakeDir, account: &TestLogosAccount) -> (u64, Vec<String>) {
+        let set = dir
+            .fetch(account.public_key())
+            .unwrap()
+            .expect("bundle published");
+        (set.lamport, set.devices)
+    }
+
+    /// First publish for an account starts at lamport 0 with the one device.
+    #[test]
+    fn first_add_delegate_signer_lists_the_signer() {
+        let mut dir = FakeDir::default();
+        let account = TestLogosAccount::new();
+        let device = Ed25519SigningKey::generate().verifying_key();
+
+        account.add_delegate_signer(&mut dir, &device).unwrap();
+
+        let (lamport, devices) = device_set(&dir, &account);
+        assert_eq!(lamport, 0);
+        assert_eq!(devices, vec![hex::encode(device.as_ref())]);
+    }
+
+    /// A second device is merged into the existing set with a bumped lamport,
+    /// preserving the first device.
+    #[test]
+    fn add_delegate_signer_merges_and_bumps_lamport() {
+        let mut dir = FakeDir::default();
+        let account = TestLogosAccount::new();
+        let first = Ed25519SigningKey::generate().verifying_key();
+        let second = Ed25519SigningKey::generate().verifying_key();
+
+        account.add_delegate_signer(&mut dir, &first).unwrap();
+        account.add_delegate_signer(&mut dir, &second).unwrap();
+
+        let (lamport, devices) = device_set(&dir, &account);
+        assert_eq!(lamport, 1);
+        assert_eq!(
+            devices,
+            vec![hex::encode(first.as_ref()), hex::encode(second.as_ref())]
+        );
+    }
+
+    /// Re-adding an already-listed device keeps the set and still bumps the
+    /// lamport (a refresh, not a duplicate).
+    #[test]
+    fn re_adding_a_device_is_idempotent_on_the_set() {
+        let mut dir = FakeDir::default();
+        let account = TestLogosAccount::new();
+        let device = Ed25519SigningKey::generate().verifying_key();
+
+        account.add_delegate_signer(&mut dir, &device).unwrap();
+        account.add_delegate_signer(&mut dir, &device).unwrap();
+
+        let (lamport, devices) = device_set(&dir, &account);
+        assert_eq!(lamport, 1);
+        assert_eq!(devices, vec![hex::encode(device.as_ref())]);
     }
 }

core/account/src/directory.rs

@@ -5,13 +5,10 @@
 //! one such bundle per account so that an inviter can resolve an account public
 //! key to every device it must invite.
 //!
-//! Two roles are kept distinct from the per-device [`IdentityProvider`]:
-//!
-//! - [`AccountAuthority`] — the injected account key. Custody (wallet, enclave,
-//!   another device) stays outside libchat; we only ever ask it to sign. Present
-//!   only where the user authorizes a device change.
-//! - [`AccountDirectory`] — the client that publishes and fetches+verifies the
-//!   bundle against the directory service.
+//! [`AccountDirectory`] is the client that publishes and fetches+verifies the
+//! bundle against the directory service. Signing a bundle is account
+//! functionality (e.g. [`TestLogosAccount::add_delegate_signer`](crate::TestLogosAccount));
+//! the account key never leaves the account type.
 //!
 //! The bundle `payload` is opaque to the server. Both the signing side
 //! ([`encode_bundle_payload`]) and the verifying side ([`verify_bundle`]) live
@@ -24,8 +21,8 @@ use shared_traits::IdentIdRef;
 use thiserror::Error;
 
 /// A device (LocalIdentity) verifying key, hex-encoded — the same shape as the
-/// keypackage registry's `device_id`, so values flow straight into
-/// [`KeyPackageProvider::retrieve`](crate::service_traits::KeyPackageProvider).
+/// keypackage registry's `device_id`, so values flow straight into a keypackage
+/// retrieval.
 pub type DeviceId = String;
 
 /// The account's monotonic version counter, bumped on every membership change.
@@ -48,8 +45,8 @@ pub const BUNDLE_VERSION: u8 = 1;
 pub const BUNDLE_DOMAIN: &[u8] = b"libchat:account-device-bundle\0";
 
 /// The signed device-list bundle. The `payload` bytes are exactly
-/// what [`AccountAuthority::sign`] signed, so verifiers check the
-/// signature over the same bytes they received.
+/// what the account signed, so verifiers check the signature over
+/// the same bytes they received.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct SignedDeviceBundle {
     /// The account verifying key this bundle belongs to. Used for addressing on
@@ -71,30 +68,10 @@ pub struct DeviceSet {
     pub devices: Vec<DeviceId>,
 }
 
-/// The account capability, injected by the platform.
-///
-/// Custody of the account key stays outside libchat — the library only ever asks
-/// it to sign a device-list bundle. The same trait covers a local on-device key
-/// (testnet) and an external signer (wallet/enclave), which is why [`sign`] is
-/// fallible: an external signer can be offline or decline the prompt.
-///
-/// Verification needs no authority — anyone holding the account verifying key
-/// verifies with [`verify_bundle`].
-///
-/// [`sign`]: AccountAuthority::sign
-pub trait AccountAuthority {
-    type Error: Display + Debug;
-
-    /// The account verifying key identifying this participant.
-    fn account_pub(&self) -> &Ed25519VerifyingKey;
-    /// Sign the canonical bundle bytes with the account key.
-    fn sign(&self, payload: &[u8]) -> Result<Ed25519Signature, Self::Error>;
-}
-
 /// Client for the account → device directory service.
 ///
-/// Mirrors [`RegistrationService`](crate::service_traits::RegistrationService):
-/// an injected trait in core with an HTTP implementation in the extension layer.
+/// Mirrors the core's `RegistrationService`: an injected trait with an HTTP
+/// implementation in the extension layer.
 /// The service is untrusted, so [`fetch`](AccountDirectory::fetch) verifies the
 /// account signature before returning a [`DeviceSet`].
 pub trait AccountDirectory: Debug {
@@ -209,22 +186,33 @@ pub fn verify_bundle(
     })
 }
 
+/// Failures resolving an account address to its device ids.
+#[derive(Debug, Error)]
+pub enum ResolveError {
+    #[error("address is not an account key")]
+    NotAnAccountKey,
+    #[error("account has published no device bundle")]
+    NoDeviceBundle,
+    #[error("directory: {0}")]
+    Directory(String),
+}
+
 /// Resolve an account to the device ids whose KeyPackages must be fetched.
 ///
-/// The directory is keyed by the account verifying key. When `account` is the hex
-/// of such a key and a bundle exists, returns its verified device set. Otherwise
-/// falls back to treating the identifier itself as a single device id — the
-/// pre-directory behaviour — so opaque or never-published ids keep working.
+/// The directory is keyed by the account verifying key: `account` must be the
+/// hex of such a key, and a reachable account has published a bundle endorsing
+/// at least one device. Anything else is an error — the distinct variants tell
+/// a malformed address, an unpublished account, and a directory outage apart.
 pub fn resolve_device_ids<D: AccountDirectory + ?Sized>(
     directory: &D,
     account: IdentIdRef,
-) -> Result<Vec<DeviceId>, D::Error> {
-    if let Some(account_key) = account_key_from_id(account)
-        && let Some(set) = directory.fetch(&account_key)?
-    {
-        return Ok(set.devices);
-    }
-    Ok(vec![account.to_string()])
+) -> Result<Vec<DeviceId>, ResolveError> {
+    let account_key = account_key_from_id(account).ok_or(ResolveError::NotAnAccountKey)?;
+    let set = directory
+        .fetch(&account_key)
+        .map_err(|e| ResolveError::Directory(e.to_string()))?
+        .ok_or(ResolveError::NoDeviceBundle)?;
+    Ok(set.devices)
 }
 
 /// Interpret an identity id as the hex of an account verifying key, if it is one.
@@ -363,12 +351,25 @@ mod tests {
         }
     }
 
-    /// No published bundle → fall back to the identifier as a single device id.
+    /// An address that is not the hex of an account key cannot be resolved.
     #[test]
-    fn resolve_falls_back_to_account_id() {
+    fn resolve_rejects_non_key_address() {
         let account = IdentId::new("pax");
-        let resolved = resolve_device_ids(&FakeDir(None), &account).unwrap();
-        assert_eq!(resolved, vec![account.to_string()]);
+        assert!(matches!(
+            resolve_device_ids(&FakeDir(None), &account),
+            Err(ResolveError::NotAnAccountKey)
+        ));
+    }
+
+    /// An account that never published a bundle is unreachable.
+    #[test]
+    fn resolve_rejects_unpublished_account() {
+        let account_pub = Ed25519SigningKey::generate().verifying_key();
+        let account_id = IdentId::new(hex::encode(account_pub.as_ref()));
+        assert!(matches!(
+            resolve_device_ids(&FakeDir(None), &account_id),
+            Err(ResolveError::NoDeviceBundle)
+        ));
     }
 
     /// A published bundle → resolve to its verified device ids (hex pubkeys).

core/account/src/lib.rs

@@ -1,5 +1,13 @@
+mod directory;
+
+pub use directory::{
+    AccountDirectory, BUNDLE_VERSION, BundleError, DecodedBundle, DeviceId, DeviceSet, Lamport,
+    ResolveError, SignedDeviceBundle, decode_bundle_payload, encode_bundle_payload,
+    resolve_device_ids, verify_bundle,
+};
+
 #[cfg(feature = "dev")]
 mod account;
 
 #[cfg(feature = "dev")]
-pub use account::TestLogosAccount;
+pub use account::{AddDelegateSignerError, TestLogosAccount};

core/conversations/src/conversation/group_v1.rs

@@ -12,7 +12,6 @@ use shared_traits::IdentIdRef;
 use std::collections::VecDeque;
 use tracing::debug;
 
-use crate::account_directory::{AccountDirectory, resolve_device_ids};
 use crate::conversation::ConversationIdRef;
 use crate::inbox_v2::MlsProvider;
 use crate::service_context::{ExternalServices, ServiceContext};
@@ -137,38 +136,27 @@ impl GroupV1Convo {
         Self::delivery_address_from_id(&self.convo_id)
     }
 
-    /// Resolve an account to a KeyPackage for *every* device it authorizes.
-    ///
-    /// First resolves the account to its device ids through the account
-    /// directory ([`resolve_device_ids`]), then fetches each device's
-    /// KeyPackage. When the account never published a bundle, resolution falls
-    /// back to a single device id equal to the account id — the pre-directory
-    /// behaviour — so single-device accounts are unaffected.
-    fn key_packages_for_account(
+    /// Fetch a signer's KeyPackage from the registry. Members are signer
+    /// (installation) ids; resolving an account to its signers is the caller's
+    /// concern, above the core.
+    fn key_package_for_signer(
         &self,
-        ident: IdentIdRef,
+        signer: IdentIdRef,
         provider: &impl MlsProvider,
-        registry: &(impl KeyPackageProvider + AccountDirectory),
-    ) -> Result<Vec<KeyPackage>, ChatError> {
-        let device_ids =
-            resolve_device_ids(registry, ident).map_err(|e| ChatError::Generic(e.to_string()))?;
+        registry: &impl KeyPackageProvider,
+    ) -> Result<KeyPackage, ChatError> {
+        let retrieved = registry
+            .retrieve(signer.as_str())
+            .map_err(|e| ChatError::Generic(e.to_string()))?;
+        let Some(keypkg_bytes) = retrieved else {
+            return Err(ChatError::Protocol(format!(
+                "no keypackage for signer {signer}"
+            )));
+        };
 
-        let mut keypackages = Vec::with_capacity(device_ids.len());
-        for device_id in &device_ids {
-            let retrieved = registry
-                .retrieve(device_id)
-                .map_err(|e| ChatError::Generic(e.to_string()))?;
-            let Some(keypkg_bytes) = retrieved else {
-                return Err(ChatError::Protocol(format!(
-                    "no keypackage for device {device_id} of account {ident}"
-                )));
-            };
-
-            let key_package_in = KeyPackageIn::tls_deserialize(&mut keypkg_bytes.as_slice())?;
-            let keypkg = key_package_in.validate(provider.crypto(), ProtocolVersion::Mls10)?; //TODO: P3 - Hardcoded Protocol Version
-            keypackages.push(keypkg);
-        }
-        Ok(keypackages)
+        let key_package_in = KeyPackageIn::tls_deserialize(&mut keypkg_bytes.as_slice())?;
+        let keypkg = key_package_in.validate(provider.crypto(), ProtocolVersion::Mls10)?; //TODO: P3 - Hardcoded Protocol Version
+        Ok(keypkg)
     }
 
     fn send_message<S: ExternalServices>(
@@ -324,12 +312,12 @@ impl<S: ExternalServices> GroupConvo<S> for GroupV1Convo {
             ));
         }
 
-        // Resolve each account to a KeyPackage per authorized device and flatten
-        // them into one list — every device of every invitee becomes an MLS
-        // leaf, so all of a user's installations join the group.
+        // Members are signer (installation) ids: one KeyPackage each, one MLS
+        // leaf each. A caller inviting an account passes every signer id the
+        // account's directory bundle lists.
         let mut keypkgs = Vec::with_capacity(members.len());
         for ident in members {
-            keypkgs.extend(self.key_packages_for_account(ident, &cx.mls_provider, &cx.registry)?);
+            keypkgs.push(self.key_package_for_signer(ident, &cx.mls_provider, &cx.registry)?);
         }
 
         let (commit, welcome, _group_info) = self
@@ -346,9 +334,9 @@ impl<S: ExternalServices> GroupConvo<S> for GroupV1Convo {
             .unwrap();
 
         // TODO: (P3) Evaluate privacy/performance implications of an aggregated Welcome for multiple users
-        for account_id in members {
+        for signer_id in members {
             cx.mls_provider
-                .invite_user(&mut cx.ds, account_id, &welcome)?;
+                .invite_user(&mut cx.ds, signer_id, &welcome)?;
         }
 
         self.send_payload(cx, commit.to_bytes()?)

core/conversations/src/conversation/group_v2.rs

@@ -17,6 +17,8 @@ use de_mls::{
 };
 use hashgraph_like_consensus::signing::EthereumConsensusSigner;
 use openmls::group::MlsGroupCreateConfig;
+use openmls::prelude::tls_codec::Deserialize as _;
+use openmls::prelude::{KeyPackageIn, OpenMlsProvider as _, ProtocolVersion};
 use prost::Message;
 use shared_traits::{IdentId, IdentIdRef};
 use std::sync::Arc;
@@ -74,8 +76,10 @@ fn demls_config() -> ConversationConfig {
 pub struct GroupV2Convo {
     convo_id: String,
     conversation: Conversation<DefaultConsensusPlugin, InMemoryPeerScoreStorage>,
-    /// Member-ids we proposed via add_member. We forward a welcome only to joiners WE invited.
-    pending_invites: Vec<Vec<u8>>,
+    /// Joiners WE invited, as `(member_id, signer_id)`: the de-mls member id
+    /// (the joiner's leaf credential content, read from its key package) paired
+    /// with the signer id its welcome is delivered to.
+    pending_invites: Vec<(Vec<u8>, String)>,
 }
 
 impl std::fmt::Debug for GroupV2Convo {
@@ -274,20 +278,32 @@ where
         members: &[IdentIdRef],
     ) -> Result<(), ChatError> {
         // Record who WE invited before touching the conversation: after_op
-        // forwards a welcome only to joiners in pending_invites (the de-mls
-        // member-id is the invitee's id bytes).
+        // forwards a welcome only to joiners in pending_invites. Members are
+        // signer ids; the de-mls member id must match the id of the
+        // IdentityProvider that generated the key package (its MLS leaf
+        // credential content — de-mls matches members by credential), so it is
+        // read from the fetched key package rather than assumed equal to the
+        // signer id.
         for member in members {
             let kp_bytes = service_ctx
                 .registry
                 .retrieve(member.as_str())
                 .map_err(ChatError::generic)?
                 .ok_or_else(|| ChatError::generic("No key package"))?;
+            let key_package_in = KeyPackageIn::tls_deserialize(&mut kp_bytes.as_slice())?;
+            let keypkg = key_package_in
+                .validate(service_ctx.mls_provider.crypto(), ProtocolVersion::Mls10)?;
+            let member_id = keypkg
+                .leaf_node()
+                .credential()
+                .serialized_content()
+                .to_vec();
             self.pending_invites
-                .push(member.as_str().as_bytes().to_vec());
+                .push((member_id.clone(), member.to_string()));
             self.conversation.add_member(
                 &service_ctx.mls_provider,
                 &service_ctx.mls_identity,
-                member.as_str().as_bytes(),
+                &member_id,
                 &kp_bytes,
             )?;
         }
@@ -314,16 +330,17 @@ impl GroupV2Convo {
         let outbound = self.conversation.drain_outbound(); // Vec<de_mls::session::Outbound>
         let wakeup = self.conversation.next_wakeup_in();
 
-        // 1. Route welcomes for joiners WE invited (event fires on every member now).
+        // 1. Route welcomes for joiners WE invited (event fires on every member
+        //    now). The welcome travels to the joiner's signer id (where its
+        //    InboxV2 listens), not its de-mls member id.
         for evt in &events {
             if let ConversationEvent::WelcomeReady { welcome, .. } = evt {
                 for joiner in &welcome.joiner_identities {
-                    if let Some(i) = self.pending_invites.iter().position(|p| p == joiner) {
-                        self.pending_invites.remove(i);
-                        let name = String::from_utf8(joiner.clone()).map_err(ChatError::generic)?;
+                    if let Some(i) = self.pending_invites.iter().position(|(p, _)| p == joiner) {
+                        let (_, signer_id) = self.pending_invites.remove(i);
                         crate::inbox_v2::invite_user_v2(
                             &mut service_ctx.ds,
-                            &IdentId::new(name),
+                            &IdentId::new(signer_id),
                             welcome,
                         )?;
                     }

core/conversations/src/core.rs

@@ -14,7 +14,7 @@ use crate::{
 };
 use crypto::{Identity, PublicKey};
 use openmls::group::GroupId;
-use shared_traits::IdentIdRef;
+use shared_traits::{IdentId, IdentIdRef};
 use std::collections::HashMap;
 use std::fmt::Debug;
 use storage::{ChatStore, ConversationKind, ConversationStore};
@@ -97,7 +97,6 @@ where
         )?;
 
         core.register_keypackage()?;
-        core.register_account_bundle()?;
         Ok(core)
     }
 
@@ -112,7 +111,12 @@ where
         store: CS,
     ) -> Result<Self, ChatError> {
         let inbox = Inbox::new(&identity);
-        let ident_id = ident.id().clone();
+        // InboxV2 rendezvous is signer-scoped: it subscribes under the hex of
+        // the signer's verifying key — the same string the account → device
+        // directory lists and the registries key key-packages under, so it is
+        // exactly what an inviter can derive for this installation. The MLS
+        // credential below still carries the full `id()`.
+        let ident_id = IdentId::new(hex::encode(ident.public_key().as_ref()));
         let mls_identity = MlsIdentityProvider::new(ident);
         let mls_provider = MlsEphemeralPqProvider::new().map_err(ChatError::generic)?;
         let causal = CausalHistoryStore::new();
@@ -153,19 +157,12 @@ impl<'a, S: ExternalServices + 'static> Core<S> {
         &self.services.store
     }
 
-    /// The account → device directory (our account store). Used to verify that a
-    /// received message's claimed account actually endorses the sending device
-    /// before the message is surfaced. Exposed as `RegistrationService`, whose
-    /// `AccountDirectory` supertrait provides `fetch`.
-    pub fn account_directory(&self) -> &S::RS {
-        &self.services.registry
-    }
-
     pub fn identity(&self) -> &Identity {
         &self.services.identity
     }
 
-    /// Returns the unique identifier associated with the account
+    /// The signer id this core receives InboxV2 invites under — the hex of the
+    /// signer's verifying key.
     pub fn ident_id(&'a self) -> IdentIdRef<'a> {
         self.pq_inbox.ident_id()
     }
@@ -177,14 +174,6 @@ impl<'a, S: ExternalServices + 'static> Core<S> {
         self.pq_inbox.register(&mut self.services)
     }
 
-    /// Publish this installation's device key into the account → device
-    /// directory, so inviters can resolve this account to its device(s). Pairs
-    /// with [`register_keypackage`](Self::register_keypackage); call both after
-    /// provisioning so the account is fully discoverable.
-    pub fn register_account_bundle(&mut self) -> Result<(), ChatError> {
-        self.pq_inbox.publish_device_bundle(&mut self.services)
-    }
-
     pub fn installation_name(&self) -> &str {
         self.services.identity.get_name()
     }

core/conversations/src/inbox_v2.rs

@@ -2,7 +2,6 @@ mod identity;
 mod mls_provider;
 
 use chat_proto::logoschat::envelope::EnvelopeV1;
-use crypto::Ed25519VerifyingKey;
 use de_mls::protos::de_mls::messages::v1::MemberWelcome;
 use openmls::prelude::tls_codec::Serialize;
 use openmls::prelude::*;
@@ -23,11 +22,7 @@ use crate::conversation::GroupV2Convo;
 use crate::conversation::Identified as _;
 use crate::service_context::{ExternalServices, ServiceContext};
 use crate::utils::{blake2b_hex, hash_size};
-use crate::{
-    AccountAuthority, AccountDirectory, AddressedEnvelope, SignedDeviceBundle,
-    encode_bundle_payload,
-};
-use crate::{IdentId, IdentIdRef, IdentityProvider};
+use crate::{AddressedEnvelope, IdentId, IdentIdRef, IdentityProvider};
 
 // Downgraded from MLS_256_XWING_CHACHA20POLY1305_SHA256_Ed25519 until demls accepts an external provider
 pub(crate) const CIPHER_SUITE: Ciphersuite =
@@ -53,33 +48,34 @@ pub trait MlsProvider: OpenMlsProvider {
     ) -> Result<(), ChatError>;
 }
 
-/// Deliver a de-mls welcome to `account_id` over its InboxV2 1-1 channel.
+/// Deliver a de-mls welcome to `signer_id` over its InboxV2 1-1 channel.
 /// Function mirroring the GroupV1 `invite_user` path, but carrying a de-mls `MemberWelcome`.
 pub fn invite_user_v2<DS: DeliveryService>(
     ds: &mut DS,
-    account_id: IdentIdRef,
+    signer_id: IdentIdRef,
     welcome: &MemberWelcome,
 ) -> Result<(), ChatError> {
     let frame = InboxV2Frame {
         payload: Some(InviteType::GroupV2(welcome.encode_to_vec())),
     };
     let envelope = EnvelopeV1 {
-        conversation_hint: conversation_id_for(account_id),
+        conversation_hint: conversation_id_for(signer_id),
         salt: 0,
         payload: frame.encode_to_vec().into(),
     };
     ds.publish(AddressedEnvelope {
-        delivery_address: delivery_address_for(account_id),
+        delivery_address: delivery_address_for(signer_id),
         data: envelope.encode_to_vec(),
     })
     .map_err(ChatError::generic)
 }
 
-/// An PQ focused Conversation initializer.
-/// InboxV2 Incorporates an Account based identity system to support PQ based conversation protocols
-/// such as MLS.
+/// A PQ focused Conversation initializer.
+/// InboxV2 is signer-scoped: it receives invites under this installation's
+/// signer id (the hex of the signer's verifying key), supporting PQ based
+/// conversation protocols such as MLS.
 pub struct InboxV2 {
-    // Account_id field is an owned value, so it can be returned via reference.
+    // Owned so it can be returned via reference.
     ident_id: IdentId,
 }
 
@@ -205,78 +201,6 @@ impl InboxV2 {
     }
 }
 
-// Publishing the account → device bundle needs the account key, so this method
-// is available only when the registry also implements `AccountDirectory`. The
-// signing authority is the `LogosAccount` wrapped by `mls_identity`; on testnet
-// that is a local key (account key == device key), while an external signer
-// would supply its own authority.
-impl InboxV2 {
-    /// Add this installation's device key to the account's directory bundle.
-    ///
-    /// Fetches the current (verified) device set, adds this device if absent,
-    /// bumps the lamport, re-signs with the account key, and publishes. Safe to
-    /// call repeatedly — an unchanged set is simply re-published, which also
-    /// refreshes the server's retention clock.
-    pub fn publish_device_bundle<S: ExternalServices>(
-        &self,
-        cx: &mut ServiceContext<S>,
-    ) -> Result<(), ChatError> {
-        // On testnet `mls_identity` doubles as the `AccountAuthority` — the
-        // account key is the installation's own key.
-        let authority = &cx.mls_identity;
-
-        let account_pub = AccountAuthority::account_pub(authority).clone();
-        let device_key = cx.mls_identity.public_key().clone();
-        let device_hex = hex::encode(device_key.as_ref());
-
-        // Start from the devices already registered so other installations of
-        // this account are preserved across the upsert.
-        let existing = cx
-            .registry
-            .fetch(&account_pub)
-            .map_err(|e| ChatError::Generic(e.to_string()))?;
-        let (mut devices, next_lamport) = match existing {
-            Some(set) => {
-                let mut keys = Vec::with_capacity(set.devices.len() + 1);
-                for hex_id in &set.devices {
-                    let bytes: [u8; 32] = hex::decode(hex_id)
-                        .ok()
-                        .and_then(|b| b.try_into().ok())
-                        .ok_or_else(|| {
-                            ChatError::Generic("directory returned a malformed device id".into())
-                        })?;
-                    let key = Ed25519VerifyingKey::from_bytes(&bytes).map_err(|_| {
-                        ChatError::Generic("directory returned a malformed device key".into())
-                    })?;
-                    keys.push(key);
-                }
-                (keys, set.lamport + 1)
-            }
-            None => (Vec::new(), 0),
-        };
-
-        if !devices
-            .iter()
-            .any(|d| hex::encode(d.as_ref()) == device_hex)
-        {
-            devices.push(device_key);
-        }
-
-        let payload = encode_bundle_payload(next_lamport, &devices);
-        let signature = AccountAuthority::sign(authority, &payload)
-            .map_err(|e| ChatError::Generic(e.to_string()))?;
-        let bundle = SignedDeviceBundle {
-            account_pub,
-            payload,
-            signature,
-        };
-
-        cx.registry
-            .publish(&bundle)
-            .map_err(|e| ChatError::Generic(e.to_string()))
-    }
-}
-
 #[derive(Clone, PartialEq, Message)]
 pub struct InboxV2Frame {
     #[prost(oneof = "InviteType", tags = "1, 2")]

core/conversations/src/inbox_v2/identity.rs

@@ -1,6 +1,5 @@
 use std::ops::Deref;
 
-use crypto::{Ed25519Signature, Ed25519VerifyingKey};
 use openmls::credentials::{BasicCredential, CredentialWithKey};
 use openmls_traits::{
     signatures::{Signer, SignerError},
@@ -8,7 +7,6 @@ use openmls_traits::{
 };
 use shared_traits::IdentIdRef;
 
-use crate::AccountAuthority;
 use crate::IdentityProvider;
 
 /// A Wrapper for an IdentityProvider which provides MLS specific functionality
@@ -57,22 +55,6 @@ impl<T: IdentityProvider> IdentityProvider for MlsIdentityProvider<T> {
     }
 }
 
-// On testnet the installation identity is also the account authority: the
-// account key is the installation's own key, so the device bundle is signed and
-// addressed under `public_key()`. A real deployment injects a separate
-// `AccountAuthority` (wallet/enclave) whose key custody lives outside libchat.
-impl<T: IdentityProvider> AccountAuthority for MlsIdentityProvider<T> {
-    type Error = std::convert::Infallible;
-
-    fn account_pub(&self) -> &Ed25519VerifyingKey {
-        self.public_key()
-    }
-
-    fn sign(&self, payload: &[u8]) -> Result<Ed25519Signature, Self::Error> {
-        Ok(IdentityProvider::sign(self, payload))
-    }
-}
-
 // Implement Signer directly for MlsIdentityProvider, so that openmls Signer contstraint
 // does not leave the module.
 impl<T: IdentityProvider> Signer for MlsIdentityProvider<T> {

core/conversations/src/lib.rs

@@ -1,4 +1,3 @@
-mod account_directory;
 mod causal_history;
 mod conversation;
 mod core;
@@ -13,11 +12,6 @@ mod service_traits;
 mod types;
 mod utils;
 
-pub use account_directory::{
-    AccountAuthority, AccountDirectory, BUNDLE_VERSION, BundleError, DecodedBundle, DeviceId,
-    DeviceSet, Lamport, SignedDeviceBundle, decode_bundle_payload, encode_bundle_payload,
-    resolve_device_ids, verify_bundle,
-};
 pub use causal_history::{Frontier, MissingMessage};
 pub use chat_sqlite::ChatStorage;
 pub use chat_sqlite::StorageConfig;

core/conversations/src/service_context.rs

@@ -49,10 +49,8 @@ pub(crate) struct ServiceContext<S: ExternalServices> {
 #[cfg(test)]
 mod test_support {
     use super::*;
-    use crate::account_directory::{AccountDirectory, DeviceSet, SignedDeviceBundle};
     use crate::types::AddressedEnvelope;
     use crate::{ChatError, IdentityProvider};
-    use crypto::Ed25519VerifyingKey;
 
     /// Delivery double that drops every payload.
     #[derive(Debug)]
@@ -81,32 +79,11 @@ mod test_support {
             &mut self,
             _identity: &dyn IdentityProvider,
             _key_bundle: Vec<u8>,
-        ) -> Result<(), <Self as RegistrationService>::Error> {
+        ) -> Result<(), Self::Error> {
             Ok(())
         }
 
-        fn retrieve(
-            &self,
-            _device_id: &str,
-        ) -> Result<Option<Vec<u8>>, <Self as RegistrationService>::Error> {
-            Ok(None)
-        }
-    }
-
-    impl AccountDirectory for NoopRegistration {
-        type Error = std::convert::Infallible;
-
-        fn publish(
-            &mut self,
-            _bundle: &SignedDeviceBundle,
-        ) -> Result<(), <Self as AccountDirectory>::Error> {
-            Ok(())
-        }
-
-        fn fetch(
-            &self,
-            _account: &Ed25519VerifyingKey,
-        ) -> Result<Option<DeviceSet>, <Self as AccountDirectory>::Error> {
+        fn retrieve(&self, _device_id: &str) -> Result<Option<Vec<u8>>, Self::Error> {
             Ok(None)
         }
     }

core/conversations/src/service_traits.rs

@@ -7,7 +7,7 @@ use std::{
     time::Duration,
 };
 
-use crate::{AccountDirectory, ConversationId, types::AddressedEnvelope};
+use crate::{ConversationId, types::AddressedEnvelope};
 
 /// A Delivery service is responsible for payload transport.
 /// This interface allows Conversations to send payloads on the wire as well as
@@ -29,25 +29,14 @@ pub trait DeliveryService: Debug {
 /// implementations that need to authenticate the submission — e.g. a network
 /// service that verifies the bundle is signed by the correct account — can
 /// sign or attest with the caller's key material.
-///
-/// On testnet a single service (the keypackage-registry) provides both the
-/// keypackage store and the account → device directory, so [`AccountDirectory`]
-/// is a supertrait: any `RegistrationService` also resolves accounts to devices.
-/// This co-location is intentional and temporary; the two can be split into
-/// separate injected services once λLEZ lands.
-pub trait RegistrationService: Debug + AccountDirectory {
-    // Disambiguated below: with `AccountDirectory` as a supertrait, a bare
-    // `Self::Error` is ambiguous between the two traits' associated types.
+pub trait RegistrationService: Debug {
     type Error: Display + Debug;
     fn register(
         &mut self,
         identity: &dyn IdentityProvider,
         key_bundle: Vec<u8>,
-    ) -> Result<(), <Self as RegistrationService>::Error>;
-    fn retrieve(
-        &self,
-        device_id: &str,
-    ) -> Result<Option<Vec<u8>>, <Self as RegistrationService>::Error>;
+    ) -> Result<(), Self::Error>;
+    fn retrieve(&self, device_id: &str) -> Result<Option<Vec<u8>>, Self::Error>;
 }
 
 /// Read-only view of a contact registry. Not part of the public API.
@@ -58,9 +47,7 @@ pub trait KeyPackageProvider: Debug {
 }
 
 impl<T: RegistrationService> KeyPackageProvider for T {
-    // Disambiguate: `RegistrationService` now has `AccountDirectory` as a
-    // supertrait, so both expose an associated `Error`.
-    type Error = <T as RegistrationService>::Error;
+    type Error = T::Error;
     fn retrieve(&self, device_id: &str) -> Result<Option<Vec<u8>>, Self::Error> {
         RegistrationService::retrieve(self, device_id)
     }

core/integration_tests_core/Cargo.toml

@@ -10,8 +10,8 @@ edition = "2024"
 # Workspace dependencies (sorted)
 chat-sqlite = { workspace = true }
 components = { workspace = true }
+crypto = { workspace = true }
 libchat = { workspace = true }
-logos-account = { workspace = true, features = ["dev"]}
 shared-traits = { workspace = true }
 
 # External dependencies (sorted)

core/integration_tests_core/src/lib.rs

@@ -1,4 +1,6 @@
 mod test_client;
+mod test_ident;
 mod wakeup;
 
 pub use test_client::TestHarness;
+pub use test_ident::TestIdent;

core/integration_tests_core/src/test_client.rs

@@ -1,5 +1,5 @@
+use crate::test_ident::TestIdent;
 use libchat::{ConversationId, Core, IdentityProvider, PayloadOutcome};
-use logos_account::TestLogosAccount;
 use shared_traits::IdentId;
 use std::collections::HashMap;
 use std::fmt::Debug;
@@ -21,14 +21,8 @@ const RAYA: usize = 1;
 const PAX: usize = 2;
 const MIRA: usize = 3;
 
-// type ClientType = CoreClient<TestLogosAccount, LocalBroadcaster, EphemeralRegistry, WP, MemStore>;
-type ClientType = Core<(
-    TestLogosAccount,
-    LocalBroadcaster,
-    EphemeralRegistry,
-    WP,
-    MemStore,
-)>;
+// type ClientType = CoreClient<TestIdent, LocalBroadcaster, EphemeralRegistry, WP, MemStore>;
+type ClientType = Core<(TestIdent, LocalBroadcaster, EphemeralRegistry, WP, MemStore)>;
 
 #[derive(Debug)]
 pub struct ReceivedMessage<T> {
@@ -151,7 +145,7 @@ impl<const N: usize> TestHarness<N> {
 
         for i in 0..N {
             let wp = ws.new_provider(i);
-            let ident = TestLogosAccount::new(Self::names(i));
+            let ident = TestIdent::new(Self::names(i));
 
             addresses.insert(i, ident.id().clone());
             let core_client =

core/integration_tests_core/src/test_ident.rs

@@ -0,0 +1,41 @@
+use crypto::{Ed25519SigningKey, Ed25519VerifyingKey};
+use libchat::IdentityProvider;
+use shared_traits::{IdentId, IdentIdRef};
+
+/// Test identity with a fixed, human-readable id ("saro"). Stands in for a
+/// device signer so core tests can address peers by name.
+pub struct TestIdent {
+    id: IdentId,
+    signing_key: Ed25519SigningKey,
+    verifying_key: Ed25519VerifyingKey,
+}
+
+impl TestIdent {
+    pub fn new(explicit_id: impl Into<String>) -> Self {
+        let signing_key = Ed25519SigningKey::generate();
+        let verifying_key = signing_key.verifying_key();
+        Self {
+            id: IdentId::new(explicit_id.into()),
+            signing_key,
+            verifying_key,
+        }
+    }
+}
+
+impl IdentityProvider for TestIdent {
+    fn id(&self) -> IdentIdRef<'_> {
+        &self.id
+    }
+
+    fn display_name(&self) -> String {
+        self.id.to_string()
+    }
+
+    fn public_key(&self) -> &Ed25519VerifyingKey {
+        &self.verifying_key
+    }
+
+    fn sign(&self, payload: &[u8]) -> crypto::Ed25519Signature {
+        self.signing_key.sign(payload)
+    }
+}

core/integration_tests_core/tests/causal_history.rs

@@ -7,8 +7,8 @@
 use std::ops::{Deref, DerefMut};
 
 use components::{EphemeralRegistry, LocalBroadcaster, MemStore};
+use integration_tests_core::TestIdent;
 use libchat::{Core, MissingMessage, WakeupService};
-use logos_account::TestLogosAccount;
 
 #[derive(Debug)]
 struct NoopWakeupService {}
@@ -18,7 +18,7 @@ impl WakeupService for NoopWakeupService {
 
 struct Client {
     inner: Core<(
-        TestLogosAccount,
+        TestIdent,
         LocalBroadcaster,
         EphemeralRegistry,
         NoopWakeupService,
@@ -29,7 +29,7 @@ struct Client {
 impl Client {
     fn init(
         core: Core<(
-            TestLogosAccount,
+            TestIdent,
             LocalBroadcaster,
             EphemeralRegistry,
             NoopWakeupService,
@@ -60,7 +60,7 @@ impl Client {
 
 impl Deref for Client {
     type Target = Core<(
-        TestLogosAccount,
+        TestIdent,
         LocalBroadcaster,
         EphemeralRegistry,
         NoopWakeupService,
@@ -82,9 +82,9 @@ fn missing_group_message_is_detected() {
     let ds = LocalBroadcaster::new();
     let rs = EphemeralRegistry::new();
 
-    let saro_account = TestLogosAccount::new("saro");
+    let saro_ident = TestIdent::new("saro");
     let saro_ctx = Core::new_with_name(
-        saro_account,
+        saro_ident,
         ds.new_consumer(),
         rs.clone(),
         NoopWakeupService {},
@@ -92,9 +92,9 @@ fn missing_group_message_is_detected() {
     )
     .unwrap();
 
-    let raya_account = TestLogosAccount::new("raya");
+    let raya_ident = TestIdent::new("raya");
     let raya_ctx = Core::new_with_name(
-        raya_account,
+        raya_ident,
         ds.clone(),
         rs.clone(),
         NoopWakeupService {},
@@ -135,9 +135,11 @@ fn missing_group_message_is_detected() {
         !missing[0].frontier.message_id().is_empty(),
         "the missing message must be identified"
     );
+    // The causal sender hint carries the sender's identity id ("saro"), not
+    // the signer id the inbox and registry key on.
     assert_eq!(
         missing[0].frontier.sender_id(),
-        saro.ident_id().as_str(),
+        "saro",
         "missing-message sender hint should attribute to Saro"
     );
 

core/integration_tests_core/tests/private_integration.rs

@@ -1,6 +1,6 @@
 use chat_sqlite::{ChatStorage, StorageConfig};
+use integration_tests_core::TestIdent;
 use libchat::{ConversationClass, Core, Introduction, PayloadOutcome, WakeupService};
-use logos_account::TestLogosAccount;
 use storage::{ConversationStore, IdentityStore};
 use tempfile::tempdir;
 
@@ -13,7 +13,7 @@ impl WakeupService for NoopWakeupService {
 }
 
 type PrivateCore = Core<(
-    TestLogosAccount,
+    TestIdent,
     LocalBroadcaster,
     EphemeralRegistry,
     NoopWakeupService,
@@ -62,18 +62,18 @@ fn ctx_integration() {
     let ds = LocalBroadcaster::new();
     let rs = EphemeralRegistry::new();
 
-    let saro_account = TestLogosAccount::new("saro");
+    let saro_ident = TestIdent::new("saro");
     let mut saro = Core::new_with_name(
-        saro_account,
+        saro_ident,
         ds.clone(),
         rs.clone(),
         NoopWakeupService {},
         ChatStorage::in_memory(),
     )
     .unwrap();
-    let raya_account = TestLogosAccount::new("raya");
+    let raya_ident = TestIdent::new("raya");
     let mut raya = Core::new_with_name(
-        raya_account,
+        raya_ident,
         ds,
         rs,
         NoopWakeupService {},
@@ -121,8 +121,8 @@ fn identity_persistence() {
     let ds = LocalBroadcaster::new();
     let rs = EphemeralRegistry::new();
     let store1 = ChatStorage::new(StorageConfig::InMemory).unwrap();
-    let alice_account = TestLogosAccount::new("alice");
-    let ctx1 = Core::new_with_name(alice_account, ds, rs, NoopWakeupService {}, store1).unwrap();
+    let alice_ident = TestIdent::new("alice");
+    let ctx1 = Core::new_with_name(alice_ident, ds, rs, NoopWakeupService {}, store1).unwrap();
     let pubkey1 = ctx1.identity().public_key();
     let name1 = ctx1.installation_name().to_string();
 
@@ -141,8 +141,8 @@ fn open_persists_new_identity() {
     let ds = LocalBroadcaster::new();
     let rs = EphemeralRegistry::new();
     let store = ChatStorage::new(StorageConfig::File(db_path.clone())).unwrap();
-    let alice_account = TestLogosAccount::new("alice");
-    let core = Core::new_from_store(alice_account, ds, rs, NoopWakeupService {}, store).unwrap();
+    let alice_ident = TestIdent::new("alice");
+    let core = Core::new_from_store(alice_ident, ds, rs, NoopWakeupService {}, store).unwrap();
     let pubkey = core.identity().public_key();
     drop(core);
 
@@ -157,18 +157,18 @@ fn open_persists_new_identity() {
 fn conversation_metadata_persistence() {
     let ds = LocalBroadcaster::new();
     let rs = EphemeralRegistry::new();
-    let alice_account = TestLogosAccount::new("alice");
+    let alice_ident = TestIdent::new("alice");
     let mut alice = Core::new_with_name(
-        alice_account,
+        alice_ident,
         ds.clone(),
         rs.clone(),
         NoopWakeupService {},
         ChatStorage::in_memory(),
     )
     .unwrap();
-    let bob_account = TestLogosAccount::new("bob");
+    let bob_ident = TestIdent::new("bob");
     let mut bob = Core::new_with_name(
-        bob_account,
+        bob_ident,
         ds,
         rs,
         NoopWakeupService {},
@@ -198,18 +198,18 @@ fn conversation_metadata_persistence() {
 fn conversation_full_flow() {
     let ds = LocalBroadcaster::new();
     let rs = EphemeralRegistry::new();
-    let alice_account = TestLogosAccount::new("alice");
+    let alice_ident = TestIdent::new("alice");
     let mut alice = Core::new_with_name(
-        alice_account,
+        alice_ident,
         ds.clone(),
         rs.clone(),
         NoopWakeupService {},
         ChatStorage::in_memory(),
     )
     .unwrap();
-    let bob_account = TestLogosAccount::new("bob");
+    let bob_ident = TestIdent::new("bob");
     let mut bob = Core::new_with_name(
-        bob_account,
+        bob_ident,
         ds,
         rs,
         NoopWakeupService {},